CVE-2025-38455 – This CVE describes a race condition vulnerabili... (How to Fix)

Q: What is the severity of CVE-2025-38455?

CVE-2025-38455 has a CVSS score of 5.5 (MEDIUM). This CVE describes a race condition vulnerability in the Linux kernel's KVM SVM implementation for SEV/SEV-ES virtual machines. It allows a crash or undefined behavior when migrating SEV/SEV-ES VMs while vCPU creation is in progress, potentially leading to host kernel crashes. This affects systems using KVM virtualization with AMD SEV/SEV-ES features enabled.

📋 TL;DR

This CVE describes a race condition vulnerability in the Linux kernel's KVM SVM implementation for SEV/SEV-ES virtual machines. It allows a crash or undefined behavior when migrating SEV/SEV-ES VMs while vCPU creation is in progress, potentially leading to host kernel crashes. This affects systems using KVM virtualization with AMD SEV/SEV-ES features enabled.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated, but appears to be recent kernel versions before the fix commits.

Operating Systems: Linux distributions using affected kernel versions with KVM and AMD SEV/SEV-ES support

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when using KVM virtualization with AMD SEV or SEV-ES features enabled and performing intra-host VM migration.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Host kernel crash leading to denial of service for all VMs on the host, potentially requiring physical reboot.

🟠

Likely Case

Crash of the specific SEV/SEV-ES VM during migration, causing service disruption for that VM.

🟢

If Mitigated

No impact if SEV/SEV-ES features are disabled or migration is avoided during vCPU creation.

🌐 Internet-Facing: LOW - This vulnerability requires local access to the hypervisor and specific virtualization operations.

🏢 Internal Only: MEDIUM - Internal virtualization administrators or automated systems performing VM migrations could trigger this.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access to the hypervisor and ability to perform VM migration operations during specific timing windows.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits 8c8e8d4d7544bb783e15078eda8ba2580e192246, b5725213149597cd9c2b075b87bc4e0f87e906c1, e0d9a7cf37ca09c513420dc88e0d0e805a4f0820, ecf371f8b02d5e31b9aa1da7f159f1b2107bdb01, fd044c99d831e9f837518816c7c366b04014d405

Vendor Advisory: https://git.kernel.org/stable/c/8c8e8d4d7544bb783e15078eda8ba2580e192246

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Reboot the host system. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable SEV/SEV-ES features

linux

Disable AMD SEV and SEV-ES features in KVM configuration if not required.

echo 0 > /sys/module/kvm_amd/parameters/sev
echo 0 > /sys/module/kvm_amd/parameters/sev_es

Avoid VM migration during vCPU operations

all

Implement policies to prevent VM migration while vCPU creation or modification operations are in progress.

🧯 If You Can't Patch

Disable AMD SEV and SEV-ES features in KVM configuration
Implement strict controls on VM migration operations and timing

🔍 How to Verify

Check if Vulnerable:

Check if kernel version is before the fix commits and if SEV/SEV-ES features are enabled: cat /sys/module/kvm_amd/parameters/sev; cat /sys/module/kvm_amd/parameters/sev_es

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version contains the fix commits and test VM migration with SEV/SEV-ES enabled during vCPU creation.

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages referencing sev_free_vcpu or VMSA page faults
VM migration failures in virtualization management logs
Host kernel crash dumps

Network Indicators:

Unusual VM migration patterns or failures

SIEM Query:

source="kernel" AND ("sev_free_vcpu" OR "VMSA" OR "Oops" OR "kernel panic")

📊 Metadata

CVE ID: CVE-2025-38455

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

EPSS Score: 0.02% exploit probability (4.4th percentile)

Published: July 25, 2025

Last Updated: December 22, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-38455, you might also want to check these: